CVE-2023-41075 is a high severity type confusion flaw that lets an app execute arbitrary code with kernel privileges. NVD scores it 7.8. Apple fixed it in macOS Ventura 13.3, iOS and iPadOS 16.4, with backports for older lines. Update to those releases or later.
What's affected
Apple's note reads: "An app may be able to execute arbitrary code with kernel privileges. A type confusion issue was addressed with improved checks." The weakness is CWE-843, access of a resource using an incompatible type.
The fixed versions in the record are:
- macOS Ventura 13.3
- macOS Big Sur 11.7.5
- macOS Monterey 12.6.4
- iOS 16.4 and iPadOS 16.4
- iOS 15.7.4 and iPadOS 15.7.4
I read Apple's macOS Ventura 13.3 security page. It lists macOS Ventura 13.3 as released on 27 March 2023, and the libpthread entry for this CVE shows it was added to the page on 21 December 2023, so the fix existed long before the CVE was public. NVD published its record on 10 January 2024. The record also cites four other Apple pages for the iOS, iPadOS and older macOS releases that I did not open.
The vector is local, low complexity, no privileges, with user interaction required, which fits the idea of a malicious app that the user installs. It is not in CISA's KEV catalog, and Apple's note does not say it is exploited in the wild.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the software version. On a Mac, run:
sw_vers
Compare the result with the list above. Any device on iOS or iPadOS 16 below 16.4, on iOS or iPadOS 15 below 15.7.4, on macOS Ventura below 13.3, Monterey below 12.6.4 or Big Sur below 11.7.5 is below the fix. Devices on newer major versions have the fix included.
The risk path is a local app, so it matters most where users can install software of their own choosing. Managed devices that install only from a controlled catalog have a smaller exposure than unmanaged ones.
What to do now
- Report operating system versions across your managed iPhones, iPads and Macs.
- Update devices below the fixed versions. Where possible, move to the current major release instead of a point release on an old line.
- Restrict app installation on managed devices to approved sources.
- Plan to retire devices that can no longer receive updates, or limit what they can reach.
- Set a minimum operating system version in your device management policy.
Why it matters
Type confusion is a memory safety bug in which the code treats an object as the wrong type and then accesses fields that are not where it expects. In kernel code, that can allow a lower-privileged app to gain the kernel's privileges, which is the outcome Apple describes here.
The impact is high because kernel access undermines the sandbox that normally keeps apps apart. The attack still needs a malicious app on the device, so the realistic defence is a combination of prompt updates and careful control over what gets installed. Apple's fix adds the missing checks and ships in routine point releases, so this is a patch hygiene story more than an emergency.
Quick check
Does this need a network attacker?
No. The vector is local, and an app already on the device has to perform the attack.
Which Mac releases carry the fix?
macOS Ventura 13.3, Monterey 12.6.4 and Big Sur 11.7.5, plus anything newer.
Sources
- Apple security content for macOS Ventura 13.3
- Other Apple pages cited by NVD: HT213673, HT213675, HT213676 and HT213677 (not opened)
- Safeguard Gold entry for CVE-2023-41075
Last reviewed: 19 October 2026.
